N8N · GHSA-rc3w-8jc8-7x3w · AI agents & MCP
FIX → >= 1.123.89 +3
n8n's MCP OAuth registration and authorization endpoints are enabled by default and need no login, so anyone can register a client with an arbitrary redirect URI. A victim who opens a crafted authorization link is sent on to that attacker-chosen address, turning the instance into an open redirector; no tokens or session data are included in the redirect.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Instances running n8n with the MCP OAuth endpoints reachable, which are enabled by default and need no authentication. Exposure depends on whether those paths are exposed to the internet or only to trusted users, and the advisory notes that blocking them at a proxy is a short-term mitigation only. Instances already on a fixed version in their release line are not affected.
Not affected if endpoints-blocked-at-proxy, patched-version
Who cares mcp, n8n, self-hosted
n8n --version or the npm package version; affected builds are below 1.123.89, 2.45.5, and depending on release line.The MCP OAuth registration and authorization endpoints are enabled by default and require no authentication. Any caller could register an OAuth client with an arbitrary redirect_uri, and a crafted authorization URL then redirected the visitor to that URI before the instance's checks ran, turning the n8n instance into an open redirector. No tokens or session data were included in the redirect. A victim had to open the crafted URL.
The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
/mcp-oauth/register and /mcp-oauth/authorize endpoints.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.46.13.0.1/mcp-oauth/register and /mcp-oauth/authorize are reachable without authentication on your instance.Upgrade to >= 1.123.89 +3
1.123.892.45.52.46.13.0.1